04-12-2009, 04:06 PM
!!This article is only for someone who do not want to fully copy the AIs, insteads, to customize the AI himself.
!!This is not an tutorial, just a list for AI changers' convenience. (Although there would be rare to see someone want to edit an AI. )
Anyways, there are some code in the AI part of the exe indicating which key combination was activated by the AIs:
D>A mov byte ptr [R+D4],3
D<A mov byte ptr [R+D5],3
D^A mov byte ptr [R+D6],3
DvA mov byte ptr [R+D7],3
D>J mov byte ptr [R+D8],3
D<J mov byte ptr [R+D9],3
D^J mov byte ptr [R+DA],3
DvJ mov byte ptr [R+DB],3
DJA mov byte ptr [R+DC],3
'>' means forward and '<': backward.
'R' in the bracket represents one of the 'eax', 'ecx', 'edx' and 'edi'. You may use 'r32' in replace of it if you want to search such lines in OllyBDG.
And there is also some lines I observed in some similar positions, but I don't know which key it represents. Maybe they represent one of the attack, jump and defense key or something else.
mov byte ptr [R+D2],1
mov byte ptr [R+D3],1
mov byte ptr [R+CA],0
mov byte ptr [R+CB],0
mov byte ptr [R+CC],0
In the following I put the codes which in the destination of AI indicates the activation of the key combinations. (For the purpose 'jmp'ing to)
!!This is not an tutorial, just a list for AI changers' convenience. (Although there would be rare to see someone want to edit an AI. )
Anyways, there are some code in the AI part of the exe indicating which key combination was activated by the AIs:
D>A mov byte ptr [R+D4],3
D<A mov byte ptr [R+D5],3
D^A mov byte ptr [R+D6],3
DvA mov byte ptr [R+D7],3
D>J mov byte ptr [R+D8],3
D<J mov byte ptr [R+D9],3
D^J mov byte ptr [R+DA],3
DvJ mov byte ptr [R+DB],3
DJA mov byte ptr [R+DC],3
'>' means forward and '<': backward.
'R' in the bracket represents one of the 'eax', 'ecx', 'edx' and 'edi'. You may use 'r32' in replace of it if you want to search such lines in OllyBDG.
And there is also some lines I observed in some similar positions, but I don't know which key it represents. Maybe they represent one of the attack, jump and defense key or something else.
mov byte ptr [R+D2],1
mov byte ptr [R+D3],1
mov byte ptr [R+CA],0
mov byte ptr [R+CB],0
mov byte ptr [R+CC],0
In the following I put the codes which in the destination of AI indicates the activation of the key combinations. (For the purpose 'jmp'ing to)
Code:
*D>J (3c0e) [John, Henry]
*D>J (5b44) [Bat]
*D>J (5ef0) [Julian]
D<J (5f0e)
00403C0E |> /395C24 20 cmp dword ptr ss:[esp+20],ebx
00403C12 |. |0F8E F6220000 jle 00405F0E
00403C18 |. |5F pop edi
00403C19 |. |5D pop ebp
00403C1A |. |5B pop ebx
00403C1B |. |C681 D8000000>mov byte ptr ds:[ecx+D8],3
00403C22 |. |B8 01000000 mov eax,1
00403C27 |. |5E pop esi
00403C28 |. |83C4 08 add esp,8
00403C2B |. |C2 1C00 retn 1C
...
00405B44 |. 396C24 20 cmp dword ptr ss:[esp+20],ebp
00405B48 |. 0F8E C0030000 jle 00405F0E
00405B4E |. 5F pop edi
00405B4F |. 5D pop ebp
00405B50 |. 5B pop ebx
00405B51 |. C681 D8000000>mov byte ptr ds:[ecx+D8],3
00405B58 |. B8 01000000 mov eax,1
00405B5D |. 5E pop esi
00405B5E |. 83C4 08 add esp,8
00405B61 |. C2 1C00 retn 1C
...
00405EF0 |. 8B43 10 mov eax,dword ptr ds:[ebx+10]
00405EF3 |. 3B41 10 cmp eax,dword ptr ds:[ecx+10]
00405EF6 |. 7E 16 jle short 00405F0E
00405EF8 |. 5F pop edi
00405EF9 |. 5D pop ebp
00405EFA |. 5B pop ebx
00405EFB |. C681 D8000000>mov byte ptr ds:[ecx+D8],3
00405F02 |. B8 01000000 mov eax,1
00405F07 |. 5E pop esi
00405F08 |. 83C4 08 add esp,8
00405F0B |. C2 1C00 retn 1C
00405F0E |> 5F pop edi
00405F0F |. 5D pop ebp
00405F10 |. 5B pop ebx
00405F11 |. C681 D9000000>mov byte ptr ds:[ecx+D9],3
00405F18 |. B8 01000000 mov eax,1
00405F1D |. 5E pop esi
00405F1E |. 83C4 08 add esp,8
00405F21 |. C2 1C00 retn 1C
(3f51) [Deep]
00403F51 |. 5F pop edi
00403F52 |. 5D pop ebp
00403F53 |. 5B pop ebx
00403F54 |. C681 CA000000>mov byte ptr ds:[ecx+CA],0
00403F5B |. B8 01000000 mov eax,1
00403F60 |. 5E pop esi
00403F61 |. 83C4 08 add esp,8
00403F64 |. C2 1C00 retn 1C
D^J (3fc1) [Deep]
00403FC1 |> \C687 DA000000>mov byte ptr ds:[edi+DA],3
00403FC8 |> 5F pop edi
00403FC9 |. 5D pop ebp
00403FCA |. 5B pop ebx
00403FCB |. B8 01000000 mov eax,1
00403FD0 |. 5E pop esi
00403FD1 |. 83C4 08 add esp,8
00403FD4 |. C2 1C00 retn 1C
(4032) [Deep]
00404032 |> \C680 D2000000>mov byte ptr ds:[eax+D2],1
00404039 |> 8B94BE 940100>mov edx,dword ptr ds:[esi+edi*4+194]
00404040 |. C682 CB000000>mov byte ptr ds:[edx+CB],0
00404047 |> 5F pop edi
00404048 |. 5D pop ebp
00404049 |. 5B pop ebx
0040404A |. B8 01000000 mov eax,1
0040404F |. 5E pop esi
00404050 |. 83C4 08 add esp,8
00404053 |. C2 1C00 retn 1C
* (4185) [Deep]
D>J (419b)
D<J (41b1)
00404185 |> \8B84AE 940100>mov eax,dword ptr ds:[esi+ebp*4+194]
0040418C |. 8BBCBE 940100>mov edi,dword ptr ds:[esi+edi*4+194]
00404193 |. 8B48 10 mov ecx,dword ptr ds:[eax+10]
00404196 |. 3B4F 10 cmp ecx,dword ptr ds:[edi+10]
00404199 |. 7E 16 jle short 004041B1
0040419B |. C687 D8000000>mov byte ptr ds:[edi+D8],3
004041A2 |. 5F pop edi
004041A3 |. 5D pop ebp
004041A4 |. 5B pop ebx
004041A5 |. B8 01000000 mov eax,1
004041AA |. 5E pop esi
004041AB |. 83C4 08 add esp,8
004041AE |. C2 1C00 retn 1C
004041B1 |> C687 D9000000>mov byte ptr ds:[edi+D9],3
004041B8 |. 5F pop edi
004041B9 |. 5D pop ebp
004041BA |. 5B pop ebx
004041BB |. B8 01000000 mov eax,1
004041C0 |. 5E pop esi
004041C1 |. 83C4 08 add esp,8
004041C4 |. C2 1C00 retn 1C
DvA (41c7) [Deep]
004041CE |. 5F pop edi
004041CF |. 5D pop ebp
004041D0 |. 5B pop ebx
004041D1 |. C682 D7000000>mov byte ptr ds:[edx+D7],3
004041D8 |. B8 01000000 mov eax,1
004041DD |. 5E pop esi
004041DE |. 83C4 08 add esp,8
004041E1 |. C2 1C00 retn 1C
D^J (4267) [Henry]
00404267 |. 5F pop edi
00404268 |. 5D pop ebp
00404269 |. 5B pop ebx
0040426A |. C682 DA000000>mov byte ptr ds:[edx+DA],3
00404271 |. B8 01000000 mov eax,1
00404276 |. 5E pop esi
00404277 |. 83C4 08 add esp,8
0040427A |. C2 1C00 retn 1C
D^J (43da) [Rudolf]
004043DA |. 8B84BE 940100>mov eax,dword ptr ds:[esi+edi*4+194]
004043E1 |. 5F pop edi
004043E2 |. 5D pop ebp
004043E3 |. 5B pop ebx
004043E4 |. C680 DA000000>mov byte ptr ds:[eax+DA],3
004043EB |. B8 01000000 mov eax,1
004043F0 |. 5E pop esi
004043F1 |. 83C4 08 add esp,8
004043F4 |. C2 1C00 retn 1C
DvJ (43fe) [Rudolf, Freeze]
004043FE |> 5F pop edi
004043FF |. 5D pop ebp
00404400 |. 5B pop ebx
00404401 |. C681 DB000000>mov byte ptr ds:[ecx+DB],3
00404408 |. B8 01000000 mov eax,1
0040440D |. 5E pop esi
0040440E |. 83C4 08 add esp,8
00404411 |. C2 1C00 retn 1C
DvJ (488f) [Firen]
0040488F |> \5F pop edi
00404890 |. 5D pop ebp
00404891 |. 5B pop ebx
00404892 |. C680 DB000000>mov byte ptr ds:[eax+DB],3
00404899 |. B8 01000000 mov eax,1
0040489E |. 5E pop esi
0040489F |. 83C4 08 add esp,8
004048A2 |. C2 1C00 retn 1C
* (4a75) [Deep(4), Rudolf, Louis, Firen(2), Freeze(2)]
D>J (4a8f)
* (6168) [Firzen]
D>J (616c)
D<J (6182)
00404A75 |> \8B84AE 940100>mov eax,dword ptr ds:[esi+ebp*4+194]
00404A7C |. 8BBCBE 940100>mov edi,dword ptr ds:[esi+edi*4+194]
00404A83 |. 8B48 10 mov ecx,dword ptr ds:[eax+10]
00404A86 |. 3B4F 10 cmp ecx,dword ptr ds:[edi+10]
00404A89 |. 0F8E F3160000 jle 00406182
00404A8F |. C687 D8000000>mov byte ptr ds:[edi+D8],3
00404A96 |. 5F pop edi
00404A97 |. 5D pop ebp
00404A98 |. 5B pop ebx
00404A99 |. B8 01000000 mov eax,1
00404A9E |. 5E pop esi
00404A9F |. 83C4 08 add esp,8
00404AA2 |. C2 1C00 retn 1C
...
00406168 |. 3BCA cmp ecx,edx
0040616A |. 7E 16 jle short 00406182
0040616C |. C687 D8000000>mov byte ptr ds:[edi+D8],3
00406173 |. 5F pop edi
00406174 |. 5D pop ebp
00406175 |. 5B pop ebx
00406176 |. B8 01000000 mov eax,1
0040617B |. 5E pop esi
0040617C |. 83C4 08 add esp,8
0040617F |. C2 1C00 retn 1C
00406182 |> C687 D9000000>mov byte ptr ds:[edi+D9],3
00406189 |. 5F pop edi
0040618A |. 5D pop ebp
0040618B |. 5B pop ebx
0040618C |. B8 01000000 mov eax,1
00406191 |. 5E pop esi
00406192 |. 83C4 08 add esp,8
00406195 |. C2 1C00 retn 1C
(4abb) [Firen(10)]
00404ABB |> \8B8CBE 940100>mov ecx,dword ptr ds:[esi+edi*4+194]
00404AC2 |. C681 D3000000>mov byte ptr ds:[ecx+D3],1
00404AC9 |. 8B94BE 940100>mov edx,dword ptr ds:[esi+edi*4+194]
00404AD0 |. 5F pop edi
00404AD1 |. 5D pop ebp
00404AD2 |. 5B pop ebx
00404AD3 |. C682 CC000000>mov byte ptr ds:[edx+CC],0
00404ADA |. B8 01000000 mov eax,1
00404ADF |. 5E pop esi
00404AE0 |. 83C4 08 add esp,8
00404AE3 |. C2 1C00 retn 1C
DvA (4caa) [Davis]
00404CAA |> \C682 D7000000>mov byte ptr ds:[edx+D7],3
00404CB1 |> 5F pop edi
00404CB2 |. 5D pop ebp
00404CB3 |. 5B pop ebx
00404CB4 |. B8 01000000 mov eax,1
00404CB9 |. 5E pop esi
00404CBA |. 83C4 08 add esp,8
00404CBD |. C2 1C00 retn 1C
DvA (4e54) [Woody]
00404E54 |> \C682 D7000000>mov byte ptr ds:[edx+D7],3
00404E5B |> 5F pop edi
00404E5C |. 5D pop ebp
00404E5D |. 5B pop ebx
00404E5E |. B8 01000000 mov eax,1
00404E63 |. 5E pop esi
00404E64 |. 83C4 08 add esp,8
00404E67 |. C2 1C00 retn 1C
D^A (4e90) [Woody]
00404E90 |. 5F pop edi
00404E91 |. 5D pop ebp
00404E92 |. 5B pop ebx
00404E93 |. C680 D6000000>mov byte ptr ds:[eax+D6],3
00404E9A |. B8 01000000 mov eax,1
00404E9F |. 5E pop esi
00404EA0 |. 83C4 08 add esp,8
00404EA3 |. C2 1C00 retn 1C
DvA (51F2) [Dennis]
004051F2 |> \5F pop edi
004051F3 |. 5D pop ebp
004051F4 |. 5B pop ebx
004051F5 |. C681 D7000000>mov byte ptr ds:[ecx+D7],3
004051FC |. B8 01000000 mov eax,1
00405201 |. 5E pop esi
00405202 |. 83C4 08 add esp,8
00405205 |. C2 1C00 retn 1C
D^A (5300) [Dennis]
00405300 |> \5F pop edi
00405301 |. 5D pop ebp
00405302 |. 5B pop ebx
00405303 |. C680 D6000000>mov byte ptr ds:[eax+D6],3
0040530A |. B8 01000000 mov eax,1
0040530F |. 5E pop esi
00405310 |. 83C4 08 add esp,8
00405313 |. C2 1C00 retn 1C
D>J (53e7) [Woody(4), Dennis(2), Mark]
004053E7 |> \8B8C9E 940100>mov ecx,dword ptr ds:[esi+ebx*4+194]
004053EE |. 8BBCBE 940100>mov edi,dword ptr ds:[esi+edi*4+194]
004053F5 |. 8B51 10 mov edx,dword ptr ds:[ecx+10]
004053F8 |. 3B57 10 cmp edx,dword ptr ds:[edi+10]
004053FB |. 0F8E 810D0000 jle 00406182
00405401 |. C687 D8000000>mov byte ptr ds:[edi+D8],3
00405408 |. 5F pop edi
00405409 |. 5D pop ebp
0040540A |. 5B pop ebx
0040540B |. B8 01000000 mov eax,1
00405410 |. 5E pop esi
00405411 |. 83C4 08 add esp,8
00405414 |. C2 1C00 retn 1C
* (545f) [Mark]
D>A (5475)
D<A (548b)
0040545F |. 8B949E 940100>mov edx,dword ptr ds:[esi+ebx*4+194]
00405466 |. 8BBCBE 940100>mov edi,dword ptr ds:[esi+edi*4+194]
0040546D |. 8B42 10 mov eax,dword ptr ds:[edx+10]
00405470 |. 3B47 10 cmp eax,dword ptr ds:[edi+10]
00405473 |. 7E 16 jle short 0040548B
00405475 |. C687 D4000000>mov byte ptr ds:[edi+D4],3
0040547C |. 5F pop edi
0040547D |. 5D pop ebp
0040547E |. 5B pop ebx
0040547F |. B8 01000000 mov eax,1
00405484 |. 5E pop esi
00405485 |. 83C4 08 add esp,8
00405488 |. C2 1C00 retn 1C
0040548B |> C687 D5000000>mov byte ptr ds:[edi+D5],3
00405492 |. 5F pop edi
00405493 |. 5D pop ebp
00405494 |. 5B pop ebx
00405495 |. B8 01000000 mov eax,1
0040549A |. 5E pop esi
0040549B |. 83C4 08 add esp,8
0040549E |. C2 1C00 retn 1C
DvJ (55e9) [John(2), Sorcerer]
004055E9 |> \5F pop edi
004055EA |. 5D pop ebp
004055EB |. C683 DB000000>mov byte ptr ds:[ebx+DB],3
004055F2 |. 5B pop ebx
004055F3 |. B8 01000000 mov eax,1
004055F8 |. 5E pop esi
004055F9 |. 83C4 08 add esp,8
004055FC |. C2 1C00 retn 1C
DvA (586f) [LouisEX, Justin]
0040586F |> /5F pop edi
00405870 |. |5D pop ebp
00405871 |. |5B pop ebx
00405872 |. |C681 D7000000>mov byte ptr ds:[ecx+D7],3
00405879 |. |B8 01000000 mov eax,1
0040587E |. |5E pop esi
0040587F |. |83C4 08 add esp,8
00405882 |. |C2 1C00 retn 1C
D^J (5906) [Sorcerer]
00405906 |> \C687 DA000000>mov byte ptr ds:[edi+DA],3
0040590D |> 5F pop edi
0040590E |. 5D pop ebp
0040590F |. 5B pop ebx
00405910 |. B8 01000000 mov eax,1
00405915 |. 5E pop esi
00405916 |. 83C4 08 add esp,8
00405919 |. C2 1C00 retn 1C
(5a3c) [Jan]
00405A3C |. 5F pop edi
00405A3D |. 5D pop ebp
00405A3E |. 5B pop ebx
00405A3F |. B8 01000000 mov eax,1
00405A44 |. 5E pop esi
00405A45 |. 83C4 08 add esp,8
00405A48 |. C2 1C00 retn 1C
D^J (5a52) [Freeze(2), Jan]
00405A52 |> 5F pop edi
00405A53 |. 5D pop ebp
00405A54 |. 5B pop ebx
00405A55 |. C680 DA000000>mov byte ptr ds:[eax+DA],3
00405A5C |. B8 01000000 mov eax,1
00405A61 |. 5E pop esi
00405A62 |. 83C4 08 add esp,8
00405A65 |. C2 1C00 retn 1C
*D>A (5bb6) [Bat]
* (5e7c) [LouisEX, Monk, Justin, Julian]
D>A (5e82) [Rudolf]
D<A (5e98) [Rudolf]
00405BAA |. 8B52 10 mov edx,dword ptr ds:[edx+10]
00405BAD |. 3B51 10 cmp edx,dword ptr ds:[ecx+10]
00405BB0 |. 0F8E E2020000 jle 00405E98
00405BB6 |. 5F pop edi
00405BB7 |. 5D pop ebp
00405BB8 |. 5B pop ebx
00405BB9 |. C681 D4000000>mov byte ptr ds:[ecx+D4],3
00405BC0 |. B8 01000000 mov eax,1
00405BC5 |. 5E pop esi
00405BC6 |. 83C4 08 add esp,8
00405BC9 |. C2 1C00 retn 1C
...
00405E7C |> \396C24 20 cmp dword ptr ss:[esp+20],ebp
00405E80 |. 7E 16 jle short 00405E98
00405E82 |> 5F pop edi
00405E83 |. 5D pop ebp
00405E84 |. 5B pop ebx
00405E85 |. C681 D4000000>mov byte ptr ds:[ecx+D4],3
00405E8C |. B8 01000000 mov eax,1
00405E91 |. 5E pop esi
00405E92 |. 83C4 08 add esp,8
00405E95 |. C2 1C00 retn 1C
00405E98 |> 5F pop edi
00405E99 |. 5D pop ebp
00405E9A |. 5B pop ebx
00405E9B |. C681 D5000000>mov byte ptr ds:[ecx+D5],3
00405EA2 |. B8 01000000 mov eax,1
00405EA7 |. 5E pop esi
00405EA8 |. 83C4 08 add esp,8
00405EAB |. C2 1C00 retn 1C
DJA (5d8a) [Henry(2), Julian]
00405D8A |> \5F pop edi
00405D8B |. 5D pop ebp
00405D8C |. 5B pop ebx
00405D8D |. C681 DC000000>mov byte ptr ds:[ecx+DC],3
00405D94 |. B8 01000000 mov eax,1
00405D99 |. 5E pop esi
00405D9A |. 83C4 08 add esp,8
00405D9D |. C2 1C00 retn 1C
* (5dfc) [Julian]
D^J (5e02) [Bat, Julian, Firzen]
00405DFC |. 396C24 20 cmp dword ptr ss:[esp+20],ebp
00405E00 |. 7E 07 jle short 00405E09
00405E02 |> C681 DA000000>mov byte ptr ds:[ecx+DA],3
00405E09 |> |5F pop edi
00405E0A |. |5D pop ebp
00405E0B |. |5B pop ebx
00405E0C |. |B8 01000000 mov eax,1
00405E11 |. |5E pop esi
00405E12 |. |83C4 08 add esp,8
00405E15 |. |C2 1C00 retn 1C
D^A (5fb9) [Julian]
00405FB9 |> \5F pop edi
00405FBA |. C685 D6000000>mov byte ptr ss:[ebp+D6],3
00405FC1 |. 5D pop ebp
00405FC2 |. 5B pop ebx
00405FC3 |. B8 01000000 mov eax,1
00405FC8 |. 5E pop esi
00405FC9 |. 83C4 08 add esp,8
00405FCC |. C2 1C00 retn 1C
(6036) [Firzen]
00406036 |. 5F pop edi
00406037 |. 5D pop ebp
00406038 |. 5B pop ebx
00406039 |. C680 D3000000>mov byte ptr ds:[eax+D3],1
00406040 |. B8 01000000 mov eax,1
00406045 |. 5E pop esi
00406046 |. 83C4 08 add esp,8
00406049 |. C2 1C00 retn 1C
D^A (60ee) [Davis(2), Woody(2), Jack(2), Jan, Firzen]
004060EE |> \5F pop edi
004060EF |. 5D pop ebp
004060F0 |. 5B pop ebx
004060F1 |. C681 D6000000>mov byte ptr ds:[ecx+D6],3
004060F8 |. B8 01000000 mov eax,1
004060FD |. 5E pop esi
004060FE |. 83C4 08 add esp,8
00406101 |. C2 1C00 retn 1C